projects / project / luci.git / blob
? search:


6708e55cb6574007b5edbd7bd91961cf2ea4a580
[project/luci.git] / contrib / fwd / src / fwd_rules.c
1 /*
2 * fwd - OpenWrt firewall daemon - iptables rule set
3 *
4 * Copyright (C) 2009 Jo-Philipp Wich <xm@subsignal.org>
5 *
6 * The fwd program is free software: you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License version 2
8 * as published by the Free Software Foundation.
9 *
10 * The fwd program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13 * See the GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with the fwd program. If not, see http://www.gnu.org/licenses/.
17 */
18
19
20 #include "fwd.h"
21 #include "fwd_addr.h"
22 #include "fwd_rules.h"
23 #include "fwd_xtables.h"
24
25
26 /* -P <chain> <policy> */
27 static void fwd_r_set_policy(
28 struct iptc_handle *h, const char *chain, const char *policy
29 ) {
30 iptc_set_policy(chain, policy, NULL, h);
31 }
32
33 /* -N <chain> */
34 static void fwd_r_new_chain(struct iptc_handle *h, const char *chain)
35 {
36 iptc_create_chain(chain, h);
37 }
38
39 /* -A <chain1> -j <chain2> */
40 static void fwd_r_jump_chain(
41 struct iptc_handle *h, const char *chain1, const char *chain2
42 ) {
43 struct fwd_xt_rule *r;
44
45 if( (r = fwd_xt_init_rule(h)) != NULL )
46 {
47 fwd_xt_get_target(r, chain2);
48 fwd_xt_append_rule(r, chain1);
49 }
50 }
51
52 /* -A <chain> -m state --state INVALID -j DROP */
53 static void fwd_r_drop_invalid(struct iptc_handle *h, const char *chain)
54 {
55 struct fwd_xt_rule *r;
56 struct xtables_match *m;
57
58 if( (r = fwd_xt_init_rule(h)) != NULL )
59 {
60 if( (m = fwd_xt_get_match(r, "state")) != NULL )
61 {
62 fwd_xt_parse_match(r, m, "--state", "INVALID");
63 fwd_xt_get_target(r, "DROP");
64 fwd_xt_append_rule(r, chain);
65 }
66 }
67 }
68
69 /* -A <chain> -m state --state RELATED,ESTABLISHED -j ACCEPT */
70 static void fwd_r_accept_related(struct iptc_handle *h, const char *chain)
71 {
72 struct fwd_xt_rule *r;
73 struct xtables_match *m;
74
75 if( (r = fwd_xt_init_rule(h)) != NULL )
76 {
77 if( (m = fwd_xt_get_match(r, "state")) != NULL )
78 {
79 fwd_xt_parse_match(r, m, "--state", "RELATED,ESTABLISHED");
80 fwd_xt_get_target(r, "ACCEPT");
81 fwd_xt_append_rule(r, chain);
82 }
83 }
84 }
85
86 /* -A INPUT -i lo -j ACCEPT; -A OUTPUT -o lo -j ACCEPT */
87 static void fwd_r_accept_lo(struct iptc_handle *h)
88 {
89 struct fwd_network_list n;
90 struct fwd_xt_rule *r;
91
92 n.ifname = "lo";
93
94 if( (r = fwd_xt_init_rule(h)) != NULL )
95 {
96 fwd_xt_parse_in(r, &n, 0);
97 fwd_xt_get_target(r, "ACCEPT");
98 fwd_xt_append_rule(r, "INPUT");
99 }
100
101 if( (r = fwd_xt_init_rule(h)) != NULL )
102 {
103 fwd_xt_parse_out(r, &n, 0);
104 fwd_xt_get_target(r, "ACCEPT");
105 fwd_xt_append_rule(r, "OUTPUT");
106 }
107 }
108
109 /* build syn_flood chain and jump rule */
110 static void fwd_r_add_synflood(struct iptc_handle *h, struct fwd_defaults *def)
111 {
112 struct fwd_proto p;
113 struct fwd_xt_rule *r;
114 struct xtables_match *m;
115 char buf[32];
116
117 /* -N syn_flood */
118 fwd_r_new_chain(h, "syn_flood");
119
120 /* return rule */
121 if( (r = fwd_xt_init_rule(h)) != NULL )
122 {
123 /* -p tcp */
124 p.type = FWD_PR_TCP;
125 fwd_xt_parse_proto(r, &p, 0);
126
127 /* -m tcp --syn */
128 if( (m = fwd_xt_get_match(r, "tcp")) != NULL )
129 {
130 fwd_xt_parse_match(r, m, "--syn");
131 }
132
133 /* -m limit --limit x/second --limit-burst y */
134 if( (m = fwd_xt_get_match(r, "limit")) != NULL )
135 {
136 sprintf(buf, "%i/second", def->syn_rate);
137 fwd_xt_parse_match(r, m, "--limit", buf);
138
139 sprintf(buf, "%i", def->syn_burst);
140 fwd_xt_parse_match(r, m, "--limit-burst", buf);
141 }
142
143 /* -j RETURN; -A syn_flood */
144 fwd_xt_get_target(r, "RETURN");
145 fwd_xt_append_rule(r, "syn_flood");
146 }
147
148 /* drop rule */
149 if( (r = fwd_xt_init_rule(h)) != NULL )
150 {
151 /* -j DROP; -A syn_flood */
152 fwd_xt_get_target(r, "DROP");
153 fwd_xt_append_rule(r, "syn_flood");
154 }
155
156 /* jump to syn_flood rule */
157 if( (r = fwd_xt_init_rule(h)) != NULL )
158 {
159 /* -p tcp */
160 p.type = FWD_PR_TCP;
161 fwd_xt_parse_proto(r, &p, 0);
162
163 /* -m tcp --syn */
164 if( (m = fwd_xt_get_match(r, "tcp")) != NULL )
165 {
166 fwd_xt_parse_match(r, m, "--syn");
167 }
168
169 /* -j syn_flood; -A INPUT */
170 fwd_xt_get_target(r, "syn_flood");
171 fwd_xt_append_rule(r, "INPUT");
172 }
173 }
174
175 /* build reject target chain */
176 static void fwd_r_handle_reject(struct iptc_handle *h)
177 {
178 struct fwd_proto p;
179 struct fwd_xt_rule *r;
180 struct xtables_target *t;
181
182 /* -N handle_reject */
183 fwd_r_new_chain(h, "handle_reject");
184
185 /* tcp reject rule */
186 if( (r = fwd_xt_init_rule(h)) != NULL )
187 {
188 /* -p tcp */
189 p.type = FWD_PR_TCP;
190 fwd_xt_parse_proto(r, &p, 0);
191
192 /* -j REJECT --reject-with tcp-reset */
193 if( (t = fwd_xt_get_target(r, "REJECT")) != NULL )
194 {
195 fwd_xt_parse_target(r, t, "--reject-with", "tcp-reset");
196 }
197
198 /* -A handle_reject */
199 fwd_xt_append_rule(r, "handle_reject");
200 }
201
202 /* common reject rule */
203 if( (r = fwd_xt_init_rule(h)) != NULL )
204 {
205 /* -j REJECT --reject-with icmp-port-unreachable */
206 if( (t = fwd_xt_get_target(r, "REJECT")) != NULL )
207 {
208 fwd_xt_parse_target(r, t, "--reject-with",
209 "icmp-port-unreachable");
210 }
211
212 /* -A handle_reject */
213 fwd_xt_append_rule(r, "handle_reject");
214 }
215 }
216
217 /* build drop target chain */
218 static void fwd_r_handle_drop(struct iptc_handle *h)
219 {
220 struct fwd_xt_rule *r;
221
222 /* -N handle_drop */
223 fwd_r_new_chain(h, "handle_drop");
224
225 /* common drop rule */
226 if( (r = fwd_xt_init_rule(h)) != NULL )
227 {
228 /* -j DROP; -A handle_drop */
229 fwd_xt_get_target(r, "DROP");
230 fwd_xt_append_rule(r, "handle_drop");
231 }
232 }
233
234 /* build accept target chain */
235 static void fwd_r_handle_accept(struct iptc_handle *h)
236 {
237 struct fwd_xt_rule *r;
238
239 /* -N handle_accept */
240 fwd_r_new_chain(h, "handle_accept");
241
242 /* common accept rule */
243 if( (r = fwd_xt_init_rule(h)) != NULL )
244 {
245 /* -j ACCEPT; -A handle_accept */
246 fwd_xt_get_target(r, "ACCEPT");
247 fwd_xt_append_rule(r, "handle_accept");
248 }
249 }
250
251 /* add comment match */
252 static void fwd_r_add_comment(
253 struct fwd_xt_rule *r, const char *t, struct fwd_zone *z,
254 struct fwd_network_list *n, struct fwd_network_list *n2
255 ) {
256 struct xtables_match *m;
257 char buf[256];
258
259 if( (m = fwd_xt_get_match(r, "comment")) != NULL )
260 {
261 if( (n != NULL) && (n2 != NULL) )
262 snprintf(buf, sizeof(buf), "%s:%s src:%s dest:%s",
263 t, z->name, n->name, n2->name);
264 else if( (n == NULL) && (n2 != NULL) )
265 snprintf(buf, sizeof(buf), "%s:%s dest:%s", t, z->name, n2->name);
266 else
267 snprintf(buf, sizeof(buf), "%s:%s src:%s", t, z->name, n->name);
268
269 fwd_xt_parse_match(r, m, "--comment", buf);
270 }
271 }
272
273 /* add --sport (if applicable) */
274 static void fwd_r_add_sport(
275 struct fwd_xt_rule *r, struct fwd_portrange *p
276 ) {
277 int proto = r->entry->ip.proto;
278 char buf[12];
279 struct xtables_match *m;
280
281 /* have portrange and proto is tcp or udp ... */
282 if( (p != NULL) && ((proto == 6) || (proto == 17)) )
283 {
284 /* get match ... */
285 if( (m = fwd_xt_get_match(r, (proto == 6) ? "tcp" : "udp")) != NULL )
286 {
287 snprintf(buf, sizeof(buf), "%u:%u", p->min, p->max);
288 fwd_xt_parse_match(r, m, "--sport", buf);
289 }
290 }
291 }
292
293 /* add --dport (if applicable) */
294 static void fwd_r_add_dport(
295 struct fwd_xt_rule *r, struct fwd_portrange *p
296 ) {
297 int proto = r->entry->ip.proto;
298 char buf[12];
299 struct xtables_match *m;
300
301 /* have portrange and proto is tcp or udp ... */
302 if( (p != NULL) && ((proto == 6) || (proto == 17)) )
303 {
304 /* get match ... */
305 if( (m = fwd_xt_get_match(r, (proto == 6) ? "tcp" : "udp")) != NULL )
306 {
307 snprintf(buf, sizeof(buf), "%u:%u", p->min, p->max);
308 fwd_xt_parse_match(r, m, "--dport", buf);
309 }
310 }
311 }
312
313 /* add --icmp-type (of applicable) */
314 static void fwd_r_add_icmptype(
315 struct fwd_xt_rule *r, struct fwd_icmptype *i
316 ) {
317 int proto = r->entry->ip.proto;
318 struct xtables_match *m;
319 char buf[32];
320
321 /* have icmp-type and proto is icmp ... */
322 if( (i != NULL) && (proto == 1) )
323 {
324 /* get match ... */
325 if( (m = fwd_xt_get_match(r, "icmp")) != NULL )
326 {
327 if( i->name[0] )
328 snprintf(buf, sizeof(buf), "%s", i->name);
329 else
330 snprintf(buf, sizeof(buf), "%u/%u", i->type, i->code);
331
332 fwd_xt_parse_match(r, m, "--icmp-type", buf);
333 }
334 }
335 }
336
337 /* add -m mac --mac-source ... */
338 static void fwd_r_add_srcmac(
339 struct fwd_xt_rule *r, struct fwd_mac *mac
340 ) {
341 struct xtables_match *m;
342 char buf[18];
343
344 if( mac != NULL )
345 {
346 if( (m = fwd_xt_get_match(r, "mac")) != NULL )
347 {
348 snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
349 mac->mac[0], mac->mac[1], mac->mac[2],
350 mac->mac[3], mac->mac[4], mac->mac[5]);
351
352 fwd_xt_parse_match(r, m, "--mac-source", buf);
353 }
354 }
355 }
356
357 /* add policy target */
358 static void fwd_r_add_policytarget(
359 struct fwd_xt_rule *r, enum fwd_policy pol
360 ) {
361 switch(pol)
362 {
363 case FWD_P_ACCEPT:
364 fwd_xt_get_target(r, "handle_accept");
365 break;
366
367 case FWD_P_REJECT:
368 fwd_xt_get_target(r, "handle_reject");
369 break;
370
371 case FWD_P_DROP:
372 case FWD_P_UNSPEC:
373 fwd_xt_get_target(r, "handle_drop");
374 break;
375 }
376 }
377
378 /* add dnat target */
379 static void fwd_r_add_dnattarget(
380 struct fwd_xt_rule *r, struct fwd_cidr *c, struct fwd_portrange *p
381 ) {
382 struct xtables_target *t;
383 char buf[32];
384
385 if( c != NULL )
386 {
387 if( (t = fwd_xt_get_target(r, "DNAT")) != NULL )
388 {
389 if( p != NULL )
390 snprintf(buf, sizeof(buf), "%s:%u-%u",
391 inet_ntoa(c->addr), p->min, p->max);
392 else
393 snprintf(buf, sizeof(buf), "%s", inet_ntoa(c->addr));
394
395 fwd_xt_parse_target(r, t, "--to-destination", buf);
396 }
397 }
398 }
399
400 /* parse comment string and look for match */
401 static int fwd_r_cmp(const char *what, const char *cmt, const char *cmp)
402 {
403 char *match;
404
405 if( (match = strstr(cmt, what)) == NULL )
406 return 0;
407
408 match += strlen(what);
409
410 if( strncmp(match, cmp, strlen(cmp)) != 0 )
411 return 0;
412
413 if( (match[strlen(cmp)] != ' ') && (match[strlen(cmp)] != '\0') )
414 return 0;
415
416 return 1;
417 }
418
419
420 static void fwd_ipt_defaults_create(struct fwd_data *d)
421 {
422 struct fwd_defaults *def = &d->section.defaults;
423 struct iptc_handle *h_filter, *h_nat;
424
425 if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
426 fwd_fatal("Unable to obtain libiptc handle");
427
428 /* policies */
429 fwd_r_set_policy(h_filter, "INPUT",
430 def->input == FWD_P_ACCEPT ? "ACCEPT" : "DROP");
431 fwd_r_set_policy(h_filter, "OUTPUT",
432 def->output == FWD_P_ACCEPT ? "ACCEPT" : "DROP");
433 fwd_r_set_policy(h_filter, "FORWARD",
434 def->forward == FWD_P_ACCEPT ? "ACCEPT" : "DROP");
435
436 /* invalid state drop */
437 if( def->drop_invalid )
438 {
439 fwd_r_drop_invalid(h_filter, "INPUT");
440 fwd_r_drop_invalid(h_filter, "OUTPUT");
441 fwd_r_drop_invalid(h_filter, "FORWARD");
442 }
443
444 /* default accept related */
445 fwd_r_accept_related(h_filter, "INPUT");
446 fwd_r_accept_related(h_filter, "OUTPUT");
447 fwd_r_accept_related(h_filter, "FORWARD");
448
449 /* default accept on lo */
450 fwd_r_accept_lo(h_filter);
451
452 /* syn flood protection */
453 if( def->syn_flood )
454 {
455 fwd_r_add_synflood(h_filter, def);
456 }
457
458 /* rule container chains */
459 fwd_r_new_chain(h_filter, "mssfix");
460 fwd_r_new_chain(h_filter, "zones");
461 fwd_r_new_chain(h_filter, "rules");
462 fwd_r_new_chain(h_filter, "redirects");
463 fwd_r_new_chain(h_filter, "forwardings");
464 fwd_r_jump_chain(h_filter, "INPUT", "rules");
465 fwd_r_jump_chain(h_filter, "FORWARD", "mssfix");
466 fwd_r_jump_chain(h_filter, "FORWARD", "zones");
467 fwd_r_jump_chain(h_filter, "FORWARD", "rules");
468 fwd_r_jump_chain(h_filter, "FORWARD", "redirects");
469 fwd_r_jump_chain(h_filter, "FORWARD", "forwardings");
470 fwd_r_new_chain(h_nat, "zonemasq");
471 fwd_r_new_chain(h_nat, "redirects");
472 fwd_r_new_chain(h_nat, "loopback");
473 fwd_r_jump_chain(h_nat, "POSTROUTING", "zonemasq");
474 fwd_r_jump_chain(h_nat, "PREROUTING", "redirects");
475 fwd_r_jump_chain(h_nat, "POSTROUTING", "loopback");
476
477 /* standard drop, accept, reject chain */
478 fwd_r_handle_drop(h_filter);
479 fwd_r_handle_accept(h_filter);
480 fwd_r_handle_reject(h_filter);
481
482
483 if( !iptc_commit(h_nat) )
484 fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));
485
486 if( !iptc_commit(h_filter) )
487 fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));
488
489 iptc_free(h_nat);
490 iptc_free(h_filter);
491 }
492
493
494 void fwd_ipt_build_ruleset(struct fwd_handle *h)
495 {
496 struct fwd_data *e;
497
498 fwd_xt_init();
499
500 for( e = h->conf; e; e = e->next )
501 {
502 switch(e->type)
503 {
504 case FWD_S_DEFAULTS:
505 printf("\n## DEFAULTS\n");
506 fwd_ipt_defaults_create(e);
507 break;
508
509 case FWD_S_INCLUDE:
510 printf("\n## INCLUDE %s\n", e->section.include.path);
511 break;
512
513 case FWD_S_ZONE:
514 case FWD_S_FORWARD:
515 case FWD_S_REDIRECT:
516 case FWD_S_RULE:
517 /* Make gcc happy */
518 break;
519 }
520 }
521 }
522
523
524 static struct fwd_zone *
525 fwd_lookup_zone(struct fwd_handle *h, const char *net)
526 {
527 struct fwd_data *e;
528 struct fwd_network_list *n;
529
530 for( e = h->conf; e; e = e->next )
531 if( e->type == FWD_S_ZONE )
532 for( n = e->section.zone.networks; n; n = n->next )
533 if( !strcmp(n->name, net) )
534 return &e->section.zone;
535
536 return NULL;
537 }
538
539 static struct fwd_network_list *
540 fwd_lookup_network(struct fwd_zone *z, const char *net)
541 {
542 struct fwd_network_list *n;
543
544 for( n = z->networks; n; n = n->next )
545 if( !strcmp(n->name, net) )
546 return n;
547
548 return NULL;
549 }
550
551 static struct fwd_addr_list *
552 fwd_lookup_addr(struct fwd_handle *h, struct fwd_network_list *n)
553 {
554 struct fwd_addr_list *a;
555
556 if( n != NULL )
557 for( a = h->addrs; a; a = a->next )
558 if( !strcmp(a->ifname, n->ifname) )
559 return a;
560
561 return NULL;
562 }
563
564 void fwd_ipt_addif(struct fwd_handle *h, const char *net)
565 {
566 struct fwd_data *e;
567 struct fwd_zone *z;
568 struct fwd_rule *c;
569 struct fwd_redirect *r;
570 struct fwd_forwarding *f;
571 struct fwd_addr_list *a, *a2;
572 struct fwd_network_list *n, *n2;
573 struct fwd_proto p;
574
575 struct fwd_xt_rule *x;
576 struct xtables_match *m;
577 struct xtables_target *t;
578
579 struct iptc_handle *h_filter, *h_nat;
580
581 if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
582 fwd_fatal("Unable to obtain libiptc handle");
583
584
585 if( !(z = fwd_lookup_zone(h, net)) )
586 return;
587
588 if( !(n = fwd_lookup_network(z, net)) )
589 return;
590
591 if( !(a = fwd_lookup_addr(h, n)) )
592 return;
593
594 printf("\n\n#\n# addif(%s)\n#\n", net);
595
596 /* Build masquerading rule */
597 if( z->masq )
598 {
599 printf("\n# Net %s (%s) - masq\n", n->name, n->ifname);
600
601 if( (x = fwd_xt_init_rule(h_nat)) != NULL )
602 {
603 fwd_xt_parse_out(x, n, 0); /* -o ... */
604 fwd_xt_get_target(x, "MASQUERADE"); /* -j MASQUERADE */
605 fwd_r_add_comment(x, "masq", z, NULL, n); /* -m comment ... */
606 fwd_xt_append_rule(x, "zonemasq"); /* -A zonemasq */
607 }
608 }
609
610 /* Build MSS fix rule */
611 if( z->mtu_fix )
612 {
613 printf("\n# Net %s (%s) - mtu_fix\n", n->name, n->ifname);
614
615 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
616 {
617 p.type = FWD_PR_TCP;
618 fwd_xt_parse_out(x, n, 0); /* -o ... */
619 fwd_xt_parse_proto(x, &p, 0); /* -p tcp */
620
621 /* -m tcp --tcp-flags SYN,RST SYN */
622 if( (m = fwd_xt_get_match(x, "tcp")) != NULL )
623 fwd_xt_parse_match(x, m, "--tcp-flags", "SYN,RST", "SYN");
624
625 /* -j TCPMSS --clamp-mss-to-pmtu */
626 if( (t = fwd_xt_get_target(x, "TCPMSS")) != NULL )
627 fwd_xt_parse_target(x, t, "--clamp-mss-to-pmtu");
628
629 /* -m comment ... */
630 fwd_r_add_comment(x, "mssfix", z, NULL, n);
631
632 /* -A mssfix */
633 fwd_xt_append_rule(x, "mssfix");
634 }
635 }
636
637 /* Build intra-zone forwarding rules */
638 for( n2 = z->networks; n2; n2 = n2->next )
639 {
640 if( (a2 = fwd_lookup_addr(h, n2)) != NULL )
641 {
642 printf("\n# Net %s (%s) - intra-zone-forwarding"
643 " Z:%s N:%s I:%s -> Z:%s N:%s I:%s\n",
644 n->name, n->ifname, z->name, n->name, n->ifname,
645 z->name, n2->name, n2->ifname);
646
647 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
648 {
649 fwd_xt_parse_in(x, n, 0); /* -i ... */
650 fwd_xt_parse_out(x, n2, 0); /* -o ... */
651 fwd_r_add_policytarget(x, z->forward); /* -j handle_... */
652 fwd_r_add_comment(x, "zone", z, n, n2); /* -m comment ... */
653 fwd_xt_append_rule(x, "zones"); /* -A zones */
654 }
655 }
656 }
657
658 /* Build inter-zone forwarding rules */
659 for( e = z->forwardings; e && (f = &e->section.forwarding); e = e->next )
660 {
661 for( n2 = f->dest->networks; n2; n2 = n2->next )
662 {
663 printf("\n# Net %s (%s) - inter-zone-forwarding"
664 " Z:%s N:%s I:%s -> Z:%s N:%s I:%s\n",
665 n->name, n->ifname, z->name, n->name, n->ifname,
666 f->dest->name, n2->name, n2->ifname);
667
668 /* Build forwarding rule */
669 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
670 {
671 fwd_xt_parse_in(x, n, 0); /* -i ... */
672 fwd_xt_parse_out(x, n2, 0); /* -o ... */
673 fwd_r_add_policytarget(x, FWD_P_ACCEPT); /* -j handle_... */
674 fwd_r_add_comment(x, "forward", z, n, n2); /* -m comment ... */
675 fwd_xt_append_rule(x, "forwardings"); /* -A forwardings */
676 }
677 }
678 }
679
680 /* Build DNAT rules */
681 for( e = z->redirects; e && (r = &e->section.redirect); e = e->next )
682 {
683 printf("\n# Net %s (%s) - redirect Z:%s N:%s I:%s\n",
684 n->name, n->ifname, z->name, n->name, n->ifname);
685
686 /* DNAT */
687 if( (x = fwd_xt_init_rule(h_nat)) != NULL )
688 {
689 fwd_xt_parse_in(x, n, 0); /* -i ... */
690 fwd_xt_parse_src(x, r->src_ip, 0); /* -s ... */
691 fwd_xt_parse_dest(x, &a->ipaddr, 0); /* -d ... */
692 fwd_xt_parse_proto(x, r->proto, 0); /* -p ... */
693 fwd_r_add_sport(x, r->src_port); /* --sport ... */
694 fwd_r_add_dport(x, r->src_dport); /* --dport ... */
695 fwd_r_add_srcmac(x, r->src_mac); /* -m mac --mac-source ... */
696 fwd_r_add_dnattarget(x, r->dest_ip, r->dest_port); /* -j DNAT ... */
697 fwd_r_add_comment(x, "redir", z, n, NULL); /* -m comment ... */
698 fwd_xt_append_rule(x, "redirects"); /* -A redirects */
699 }
700
701 /* Forward */
702 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
703 {
704 fwd_xt_parse_in(x, n, 0); /* -i ... */
705 fwd_xt_parse_src(x, r->src_ip, 0); /* -s ... */
706 fwd_xt_parse_dest(x, r->dest_ip, 0); /* -d ... */
707 fwd_xt_parse_proto(x, r->proto, 0); /* -p ... */
708 fwd_r_add_srcmac(x, r->src_mac); /* -m mac --mac-source ... */
709 fwd_r_add_sport(x, r->src_port); /* --sport ... */
710 fwd_r_add_dport(x, r->dest_port); /* --dport ... */
711 fwd_r_add_policytarget(x, FWD_P_ACCEPT); /* -j handle_accept */
712 fwd_r_add_comment(x, "redir", z, n, NULL); /* -m comment ... */
713 fwd_xt_append_rule(x, "redirects"); /* -A redirects */
714 }
715
716 /* Add loopback rule if neither src_ip nor src_mac are defined */
717 if( !r->src_ip && !r->src_mac )
718 {
719 if( (x = fwd_xt_init_rule(h_nat)) != NULL )
720 {
721 fwd_xt_parse_in(x, n, 1); /* -i ! ... */
722 fwd_xt_parse_dest(x, r->dest_ip, 0); /* -d ... */
723 fwd_xt_parse_proto(x, r->proto, 0); /* -p ... */
724 fwd_r_add_sport(x, r->src_port); /* --sport ... */
725 fwd_r_add_dport(x, r->src_dport); /* --dport ... */
726 fwd_xt_get_target(x, "MASQUERADE"); /* -j MASQUERADE */
727 fwd_r_add_comment(x, "redir", z, n, NULL); /* -m comment ... */
728 fwd_xt_append_rule(x, "loopback"); /* -A loopback */
729 }
730 }
731 }
732
733 /* Build rules */
734 for( e = z->rules; e && (c = &e->section.rule); e = e->next )
735 {
736 /* Has destination, add forward rule for each network in target zone */
737 if( c->dest )
738 {
739 for( n2 = c->dest->networks; n2; n2 = n2->next )
740 {
741 printf("\n# Net %s (%s) - rule+dest"
742 " Z:%s N:%s I:%s -> Z:%s N:%s I:%s\n",
743 n->name, n->ifname, z->name, n->name, n->ifname,
744 f->dest->name, n2->name, n2->ifname);
745
746 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
747 {
748 fwd_xt_parse_in(x, n, 0); /* -i ... */
749 fwd_xt_parse_out(x, n2, 0); /* -o ... */
750 fwd_xt_parse_src(x, c->src_ip, 0); /* -s ... */
751 fwd_xt_parse_dest(x, c->dest_ip, 0); /* -d ... */
752 fwd_xt_parse_proto(x, c->proto, 0); /* -p ... */
753 fwd_r_add_icmptype(x, c->icmp_type); /* --icmp-type ... */
754 fwd_r_add_srcmac(x, c->src_mac); /* --mac-source ... */
755 fwd_r_add_sport(x, c->src_port); /* --sport ... */
756 fwd_r_add_dport(x, c->dest_port); /* --dport ... */
757 fwd_r_add_policytarget(x, c->target); /* -j handle_... */
758 fwd_r_add_comment(x, "rule", z, n, n2); /* -m comment ... */
759 fwd_xt_append_rule(x, "rules"); /* -A rules */
760 }
761 }
762 }
763
764 /* No destination specified, treat it as input rule */
765 else
766 {
767 printf("\n# Net %s (%s) - rule Z:%s N:%s I:%s\n",
768 n->name, n->ifname, z->name, n->name, n->ifname);
769
770 if( (x = fwd_xt_init_rule(h_filter)) != NULL )
771 {
772 fwd_xt_parse_in(x, n, 0); /* -i ... */
773 fwd_xt_parse_src(x, c->src_ip, 0); /* -s ... */
774 fwd_xt_parse_dest(x, c->dest_ip, 0); /* -d ... */
775 fwd_xt_parse_proto(x, c->proto, 0); /* -p ... */
776 fwd_r_add_icmptype(x, c->icmp_type); /* --icmp-type ... */
777 fwd_r_add_srcmac(x, c->src_mac); /* --mac-source ... */
778 fwd_r_add_sport(x, c->src_port); /* --sport ... */
779 fwd_r_add_dport(x, c->dest_port); /* --dport ... */
780 fwd_r_add_policytarget(x, c->target); /* -j handle_... */
781 fwd_r_add_comment(x, "rule", z, n, NULL); /* -m comment ... */
782 fwd_xt_append_rule(x, "rules"); /* -A rules */
783 }
784 }
785 }
786
787 if( !iptc_commit(h_nat) )
788 fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));
789
790 if( !iptc_commit(h_filter) )
791 fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));
792
793 iptc_free(h_nat);
794 iptc_free(h_filter);
795 }
796
797
798 static void fwd_ipt_delif_table(struct iptc_handle *h, const char *net)
799 {
800 struct xt_entry_match *m;
801 struct ipt_entry *e;
802 const char *chain, *comment;
803 size_t off = 0, num = 0;
804
805 /* iterate chains */
806 for( chain = iptc_first_chain(h); chain;
807 chain = iptc_next_chain(h)
808 ) {
809 /* iterate rules */
810 for( e = iptc_first_rule(chain, h), num = 0; e;
811 e = iptc_next_rule(e, h), num++
812 ) {
813 repeat_rule:
814
815 /* skip entries w/o matches */
816 if( ! e->target_offset )
817 continue;
818
819 /* iterate matches */
820 for( off = sizeof(struct ipt_entry);
821 off < e->target_offset;
822 off += m->u.match_size
823 ) {
824 m = (void *)e + off;
825
826 /* yay */
827 if( ! strcmp(m->u.user.name, "comment") )
828 {
829 /* better use struct_xt_comment_info but well... */
830 comment = (void *)m + sizeof(struct xt_entry_match);
831
832 if( fwd_r_cmp("src:", comment, net) )
833 {
834 e = iptc_next_rule(e, h);
835 iptc_delete_num_entry(chain, num, h);
836
837 if( e != NULL )
838 goto repeat_rule;
839 else
840 break;
841 }
842 }
843 }
844 }
845 }
846 }
847
848 void fwd_ipt_delif(struct fwd_handle *h, const char *net)
849 {
850 struct iptc_handle *h_filter, *h_nat;
851
852 if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
853 fwd_fatal("Unable to obtain libiptc handle");
854
855
856 printf("\n\n#\n# delif(%s)\n#\n", net);
857
858 /* delete network related rules */
859 fwd_ipt_delif_table(h_nat, net);
860 fwd_ipt_delif_table(h_filter, net);
861
862
863 if( !iptc_commit(h_nat) )
864 fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));
865
866 if( !iptc_commit(h_filter) )
867 fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));
868
869 iptc_free(h_nat);
870 iptc_free(h_filter);
871 }
872
873
874 static void fwd_ipt_clear_ruleset_table(struct iptc_handle *h)
875 {
876 const char *chain;
877
878 /* pass 1: flush all chains */
879 for( chain = iptc_first_chain(h); chain;
880 chain = iptc_next_chain(h)
881 ) {
882 iptc_flush_entries(chain, h);
883 }
884
885 /* pass 2: remove user defined chains */
886 for( chain = iptc_first_chain(h); chain;
887 chain = iptc_next_chain(h)
888 ) {
889 if( ! iptc_builtin(chain, h) )
890 iptc_delete_chain(chain, h);
891 }
892 }
893
894 void fwd_ipt_clear_ruleset(struct fwd_handle *h)
895 {
896 struct iptc_handle *h_filter, *h_nat;
897
898 if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
899 fwd_fatal("Unable to obtain libiptc handle");
900
901 /* flush tables */
902 fwd_ipt_clear_ruleset_table(h_nat);
903 fwd_ipt_clear_ruleset_table(h_filter);
904
905 /* revert policies */
906 fwd_r_set_policy(h_filter, "INPUT", "ACCEPT");
907 fwd_r_set_policy(h_filter, "OUTPUT", "ACCEPT");
908 fwd_r_set_policy(h_filter, "FORWARD", "ACCEPT");
909
910
911 if( !iptc_commit(h_nat) )
912 fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));
913
914 if( !iptc_commit(h_filter) )
915 fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));
916
917 iptc_free(h_nat);
918 iptc_free(h_filter);
919 }
920
Lua Configuration Interface (mirror)